[Unit]
Description=kubernetes-apiserver
After=network.target
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart={{ kubernetes_path}}/server/bin/kube-apiserver \
      --apiserver-count {{ groups.apiserver|length }} \
      --allow-privileged  \
      --audit-log-path {{ apiserver_log_path }}/audit.log \
      --audit-policy-file {{ kubernetes_path }}/server/conf/audit-policy.yaml \
      --authorization-mode AlwaysAllow \
      --client-ca-file {{ kubernetes_path }}/server/certs/ca.pem \
      --requestheader-client-ca-file {{ kubernetes_path }}/server/certs/ca.pem \
      --enable-admission-plugins NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota \
      --etcd-cafile {{ kubernetes_path }}/server/certs/ca.pem \
      --etcd-certfile {{ kubernetes_path }}/server/certs/etcd-client.pem \
      --etcd-keyfile {{ kubernetes_path }}/server/certs/etcd-client-key.pem \
      --etcd-servers {% for host in groups.etcd %}https://{{ host }}:2379{% if not loop.last %},{% endif %}{% endfor %} \
      --service-account-key-file {{ kubernetes_path }}/server/certs/ca-key.pem \
      --service-cluster-ip-range {{ cluster_cidr_service }} \
      --service-node-port-range {{ service_node_port_range }} \
      --kubelet-client-certificate {{ kubernetes_path }}/server/certs/kubelet-client.pem \
      --kubelet-client-key {{ kubernetes_path }}/server/certs/kubelet-client-key.pem \
      --tls-cert-file {{ kubernetes_path }}/server/certs/apiserver.pem \
      --tls-private-key-file {{ kubernetes_path }}/server/certs/apiserver-key.pem \
      --v 2 \
      --secure-port 6443 \
      --service-account-signing-key-file {{ kubernetes_path }}/server/certs/ca-key.pem \
      --service-account-issuer "false" \
      --enable-aggregator-routing \
      --requestheader-allowed-names "" \
      --requestheader-group-headers X-Remote-Group \
      --requestheader-username-headers X-Remote-User \
      --requestheader-extra-headers-prefix X-Remote-Extra- \
      --requestheader-client-ca-file /usr/local/kubernetes/server/certs/ca.pem \
      --proxy-client-cert-file /usr/local/kubernetes/server/certs/kubelet-client.pem \
      --proxy-client-key-file /usr/local/kubernetes/server/certs/kubelet-client-key.pem
Restart=on-failure
RestartSec=1

[Install]
WantedBy=multi-user.target
